29f743eb84dc7c649dd57dba7c389dc3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29f743eb84dc7c649dd57dba7c389dc3_JaffaCakes118
Size

3KB
MD5

29f743eb84dc7c649dd57dba7c389dc3
SHA1

59ac370c6bdc4f0bd0d1c7f3a5678d284d75178c
SHA256

57b32902add1a0f00a898bfc2a8881d18dfed05e667e503f7ee34436eb518615
SHA512

7f3e3ec91f22eef445ec72501119c033c4d8e4315734d15ad682af19b5aa1c86cd7a503a2f79df3b2b35daa174797f11eb7fb3c461026bb353c15462d14fa4e4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f743eb84dc7c649dd57dba7c389dc3_JaffaCakes118

Files

29f743eb84dc7c649dd57dba7c389dc3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

98356fcf908ce80069b3cd187e338747

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
UnmapViewOfFile
lstrlenA
MapViewOfFile
OpenFileMappingA
HeapAlloc
GetProcessHeap

user32

ToAsciiEx
GetKeyboardLayout
GetKeyboardState
PostMessageA
CallNextHookEx
SetWindowsHookExA
SetKeyboardState
GetKeyNameTextA
MapVirtualKeyExA

Exports

Exports

InstallHook

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ